DoS Threats for Cognitive Radio Wireless Networks

1. DoS Threats for Cognitive Radio Wireless Networks Carl A. Gunter University of Illinois With Omid Fatemieh and Ranveer Chandra

2. Environments/Applications for Cognitive Radio Communication • Emergency response networks, building automation, battlefield, advanced meter infrastructure, industrial plant monitoring, and hospitals • Hospital environment • Devices • Communication scenarios • Risks

3. Wireless Devices in Medical / Building Automation • Medical wireless network • Medical Devices: • X-Ray, EMG • Wireless ECG, Pulse oximeter, implantable defibrillator • Wireless armband, proximity cards • Nurse / doctor hand-held devices • Hospital laptops / computers / servers • Building automation wireless network • Sensing Devices: thermostat, motion detector, camera, card reader • Back-end control system

4. DoS Threat via Control Channel Jamming • MACs that use a common control channel for coordinating access to a wider frequency spectrum (data channels) • Examples: Ad-hoc and cognitive radio MACs (HRMA [Yang et al. 99],DCA [Wu et al. 00], MMAC [So et al. 04],CMAC [Yuan et al. 07], etc.) • Problem: An attacker that jams the control channel can effectively deny access to the entire frequency spectrum • Existing solutions to the jamming problemin ad-hoc / sensor domain [Xu et al. 04 & 07]: • Coordinated Channel Switching:Entire network changes its channel to a new channel • Spectral Multiplexing: Nodes in the jammed region switch to a new channel, and boundary nodes switch back and forth between new and old channels (as relays) Data Channels Frequency Control Channel

5. Problem with Existing Work • Previous work assumes a benign attacker that is: • Outsider: • A common knowledge of a secret next channel generator exists among all legitimate nodes • Attacker does not have access to this secret • Non-aggressive: • Attacker does not follow nodes to new channels quickly • Attacker does not randomly change channels quickly • A smartattacker that captures a node, or is an insider violates the assumptions and breaks the defense • Question: Is there a MAC layer defense mechanism that can withstand smart insider attacks?

6. DoS Risks in Hospitals • Examples: • ECG unable to communicate to its base • Clinician unable to take critical readings in emergency situations • Clinician unable to configure devices properly • Periodic readings of pulse oximeter cannot be stored in patient’s records • Temperature hikes due to thermostat communication problems • Authorized people locked in or out of rooms

7. The Setting • Assumptions: • Nodes can detect jamming with high probability [Xu et al. 05] • At the time of jamming, a total of K channels available for (control channel) communication • The attacker can jam at most J channels at any time (J < K): abstraction of an attacker that can capture at most J nodes • Security among nodes • No security: an entirely open network • Uniform system-wide security: key shared by all insider nodes • Multi-class system-wide security: L security classes exist. A key is associated with each class and shared by members. A node belongs to one or more classes. • Pair-wise security: Each node can authenticate, share a secret, and trust its neighbors to various degrees

8. Approach • No security / Uniform system-wide security: Use existing channel switching mechanisms. If attacker follows, switch to random channel hopping • Multi-class system-wide security: • Divide time to super-frames of L slots each • In j-th slot of each super-frame, nodes in class j hop to a channel determined by class j’s shared key • Nodes randomly hop at slots for which they don’t possess the key • Class membership criteria: criticality, compromise probability, need to communicate • Pair-wise security: • Neighbors A and B reserve their next meeting time upon each encounter • The channel for the meeting is determined by their shared key • Each node can prioritize (ignore) more (less) trustworthy neighbors in scheduling Super Frame (L slots) j-th slot

9. Questions

10. Images and Background Slides

11. Reservation Scheme

12. DoS Threat via Control Channel Jamming • MACs that use a common control channel for coordinating access to a wider frequency spectrum (data channels) • Examples: Ad-hoc and cognitive radio MACs (HRMA [Yang et al. 99],DCA [Wu et al. 00], MMAC [So et al. 04],CMAC [Yuan et al. 07], etc.) • Problem: An attacker that jams the control channel can effectively deny access to the entire frequency spectrum Data Channels Frequency Control Channel

13. Related Work • Frequency hopping spread spectrum • Deployed at a lower layer with fine granularity • All nodes should use the same code for it to work in control channel MACs • Central Access Point (AP) • Without insiders: [Gummadi et al. 07, Navda et al. 07] • With insiders: [Tague et al. 07, Noubir et al. 07, Chiang et al. 08] • Ad-hoc / sensor networks [Xu et al. 04 & 07]: • Coordinated Channel Switching:Entire network changes its channel to a new channel • Spectral Multiplexing: Nodes in the jammed region switch to a new channel, and boundary nodes switch back and forth between new and old channels (as relays)